DRSN Network Security Guide 2008 dm

ii

DISAC 300-115-XX

Defense Information Systems Agency

DISA Circular 300-115-7*

FOR OFFICAL USE ONLY

COMMUNICATIONS SECURITY

Defense RED switch Network (DRSN) Security

1. Purpose. This circular outlines roles and responsibilities and details procedures for protecting the hardware, software, databases, and operating commands that control the functioning of the Defense RED switch Network (DRSN). Specifically, this Circular addresses security of the DRSN.

2. Applicability. This Circular applies to the Defense Information Systems Agency (DISA), military departments (MILDEPs), and other DoD components and government agencies including their contractors that are served by the DRSN or whose RED (secure) switch interconnects with the DRSN.

3. Authority. This Circular is published in accordance with the authority contained in DoD Directive 5105.19, Defense Information Systems Agency (DISA), 25 July 2006.

4. References.

4.1 Director of Central Intelligence (DCI) Directive 6/3, Protecting Sensitive Compartmented Information Within Information Systems, 5 June 1999.

4.2 NSTISS Instruction 4010, Keying Material Management, 17 June 1993.

4.3 NSTISS Authority Manual TEMPEST/2-95, RED/Black Installation Guidance, 12 December 1995.

4.4 NSTISS Instruction 7003, Protected Distribution Systems (PDS), 13 December 1996.

4.5 DoD Directive 5200.1-R, Information Security Program Regulation, January 1997.

4.6 DoD 5400.7-R, DoD Freedom of Information Act Program, September 1998.

4.7 DoD Directive 5230.24, Distribution Statement on Technical Documents, 18 March 1987.

4.8 DoD Directive 5230.9, Clearance of DoD Information for Public Release, 9 April 1996.

4.9 DoDI 8510.01,Information Assurance Certification and Accreditation Process (DIACAP) 28 November 2007.

4.10 DISA Circular 800-70-1, Operation and Control of the Defense Satellite Communications System (DSCS), 15 April 1998.

4.11 DISA Circular 310-65-1, Circuit and Trunk File Data Elements and Codes Manual of the Global Information Grid, 25 April 2002.

4.12 NSTISS Instruction 4002, Classification Guide for COMSEC Information, 5 June 1986.

4.13 DCI Directive 1/21, Physical Security Standards for Sensitive Compartmented Information Facilities, 30 January 1994.

4.14 DIA Manual 50-4, Security of Compartmented Computer Operations, 24 June 1980.

5. Glossary of Terms and Definitions. Definitions for communications security (COMSEC) and automated information systems (AISs) security terms used in this circular are contained in National Security Telecommunications and Information Systems Security (NSTISS) Instruction 4009, National Information Systems Security (INFOSEC) Glossary, Revision 2, May 2003. A glossary of terms follows the table of contents.

6. System Overview.

6.1 DRSN RED switches are located in Top Secret RED enclaves. DRSN RED switches at the National Military Command Center (NMCC), the NMCC Site R, and the headquarters of the combatant and support commands, as well as others that have subscriber terminals authorized to process Sensitive Compartmented Information (SCI), are located in SCI Facilities (SCIFs). DRSN RED switches provide the following services:

6.1.1 In the clear calling within each RED enclave by means of protected distribution systems (PDS).

6.1.2 Cryptographically protected calling between RED enclaves supported by DRSN RED switches.

6.1.3 DRSN RED switch interfaces to external cryptographic equipment for all other calling.

6.2 DRSN RED switches support up to Top Secret (TS) and SCI communications and do not connect to Confidential or unclassified end instruments. However, the DRSN Black switch will connect approved end instruments to unclassified networks. DRSN BLACK switches are programmed to provide subscriber instruments with identification and security displays similar to those associated with the operation of Secure Telephone Unit - Third Generation (STU-III) cryptographic equipment.

7. The Office of Primary Responsibility (OPR) is DISA DRSN Division, NS4. This guidance is issued by:

DISA

Attn: NS4

P.O. Box 4502

Arlington, VA 22204-4502

Telephone numbers – Comm. (703)882-0322 or DSN (312)381-0332.

8. Extracts, Reproduction, and Local Implementation. Authority is granted to make reproductions or extracts of selected portions of this Circular for use by specified groups involved in the DRSN, including industrial activities. If any local implementation of this Circular is developed (e.g. standard operation procedures), a copy should be furnished to DISA NS4.

FOR THE DIRECTOR:

ROBERT L. BETHEA, JR.

Colonel, USA

Chief of Staff

OPR: NS4

DISTRIBUTION: F

SUMMARY OF SIGNIFICANT CHANGES. This revision removes all reference to hard-copy publications as all DISA numbered publications will be prepared and processed for Web dissemination. The use of Microsoft Word .doc will now be used to prepare all DISA numbered publications with the standard word-processing software package. Additional distribution codes are now included to provide for appropriate Web dissemination depending on the classification or sensitivity of a DISA numbered publication.

*This Instruction cancels DISAC 300-115-7, January 1995. OPR: WE3393 DISTRIBUTION: SPECIAL

Return to:

Top of Document DISAC 300-115-7 Table of Contents DISAC 300-115-7 Glossary DISAC 300-115-7 Chapter 1 Publications Listing DISA Home Page pubs@ncr.disa.mil - Last Revision: 28 Oct 2008

Basic Circular

11. Purpose.

12. Applicability.

13. Authority.

14. References.

25. Glossary of Terms and Definitions.

26. System Overview.

37. The Office of Primary Responsibility

38. Extracts, Reproduction, and Local Implementation.

12C1. CHAPTER 1. Overview

12C1.1 General.

12C1.2 Description of the DRSN.

13C1.3 Roles and Responsibilities.

18C1.4 System Security Threats.

20C2. CHAPTER 2. Requirements, Accreditation, Security, And Authentication

20C2.1 General.

20C2.2 Requirements.

20C2.3 Accreditation.

20C2.4 Security Criteria.

25C2.5 Authentication.

27C2.6 Terminal Displays.

28C2.7 Network Expansion.

29C3. CHAPTER 3. Architecture

29C3.1 General.

29C3.2 Fundamental Principles of Security.

30C3.3 System Elements

31C3.4 Network Security Features.

39C3.5. Network Management Mechanisms.

55C4. CHAPTER 4. Security Requirements

55C4.1 General.

55C4.2 Purpose

55C4.3 Criteria and Requirements.

59C4.4 Controls.

61C4.5 Local Options.

62C4.6 Violation Reporting.

63C5. CHAPTER 5. CLASSIFICATION GUIDANCE

63C5.1 General.

63C5.2 Classification Authority.

63C5.3 Use of Security Classification Guidance.

63C5.4 Contractor Security.

64C5.5 Related Programs.

64C5.6 For Official Use Only (FOUO) Information.

64C5.7 Classification of Extracts.

64C5.8 Downgrading and Declassification.

64C5.9 Dissemination.

65C5.10 Classification Recommendations.

65C5.11 Public Release.

65C5.12 Classification Guidance for Related Programs.

66C5.13 Threat Data.

66C5.14 Classification Guidance.

67C5.15 Organization of Tables.

87C6. CHAPTER 6. SITE CERTIFICATION AND ACCREDITATION

87C6.1 General.

87C6.2 Certification.

88C6.3 Roles and Responsibilities.

90C6.4 Network Accreditation Procedures.

91C6.5 Switch Accreditation Requirements.

95C6.6 Collateral Accreditation.

List of Tables

45Table 3‑1. SECURITY ALLOCATION CHART

46Table 3‑2. DRSN CATEGORY I SWITCHES

49Table 3‑3. STANDARD RED SWITCH SECURITY LEVEL ASSIGNMENTS

50Table 3‑4. EXAMPLE FIXED SECURITY ACCES LEVEL (FSAL) RESOLUTION

51Table 3‑5. EXAMPLE VARIABLE SECURITY ACCESS LEVEL (VSAL) RESOLUTION

52Table 3‑6. EXAMPLE variable security access level (VSAL)-TO- fixed security access level (FSAL) RESOLUTION

53Table 3‑7. STU-III/R INTERFACES

54Table 3‑8. SECURITY ACCESS LEVEL (SAL) MAPPING

70Table 5‑1. DRSN SYSTEM REQUIREMENTS AND CONCEPTS

73Table 5‑2. DRSN PLANNING AND PROGRAMMING

74Table 5‑3. DRSN ACQUISITION AND TRANSITION

77Table 5‑4. DRSN TESTING AND EVALUATION

78Table 5‑5. DRSN SYSTEM MANAGEMENT

87Table 6‑1. ITSEC CLASS CHARACTERISTICS

List of Figures

41Figure 3‑1. DRSN ARCHITECTURE

42Figure 3‑2. DRSN INTERFACES

43Figure 3‑3. PROMINA INTERFACES WITH RED SWITCH NODE

44Figure 3‑4. TRANSFERING CREDENTIALS OF SECURE USERS

DISAC 300-115-7 Basic Circular DISAC 300-115-7 Glossary DISAC 300-115-7 Chapter 1 Publications Listing

Glossary of Terms

Organization

DISAC 300-115-7 Basic Circular DISAC 300-115-7 Table of Contents DISAC 300-115-7 Chapter 1 Publications Listing

C1. CHAPTER 1. Overview

C1.1 General. This chapter provides a brief description of the Defense RED switch Network (DRSN), an outlining of the roles and responsibilities of management and user organizations, and an overview of system security threats.

C1.2 Description of the DRSN.

C1.2.1 The Office of the Joint Chiefs of Staff (JCS), in coordination with DISA and the military departments (MILDEPs), planned and established the DRSN. The DRSN provides fast-connecting, high quality, secure command and control (C2) telephone communications to the National Military Command Center (NMCC) structure. The DRSN serves the secure voice needs of the NMCC, the NMCC Site-R, and the primary command centers of the combatant, support commands, and agencies. This includes the component commands, subordinate organizations, other agencies, and our allies. It is an integral part of the Center for Defense Information System Network (DISN) Services.

C1.2.2 The DRSN provides end-to-end, dedicated switched, secure voice service for the Department of Defense (DoD). DRSN RED switches are located in Top Secret (RED) enclaves. DRSN RED switches serve C2 secure voice users located within physically securable RED enclaves. DRSN service may also be extended outside the switch enclave provided the area is approved for operations at the highest classification of the instrument (i.e., combatant commander quarters). The DRSN uses secure interswitch trunks to provide communications capabilities among the enclaves. The DRSN network also accommodates conferencing and provides interfaces to other secure voice systems. Additionally, the DRSN provides a multilevel precedence and preemption (MLPP) capability.

C1.2.3 The DRSN is comprised of RED and BLACK switches (the switching subsystem), interswitch trunks (the transmission subsystem), the network management subsystem, and the timing and synchronization subsystem.

C1.2.4 Each DRSN RED switch node consists of a RED switch, associated RED Network Integrated Technologies Inc., PROMINA multiplexers, channel service units (CSU), encryption devices, subscriber terminals (i.e., single and multiline phone and command center, attendant, administration, and maintenance consoles), PDSs to connect terminals to their associated switches, elements of the timing and synchronization subsystem, and local elements of the DRSN network management system. DRSN RED switching nodes are connected by encrypted government owned or leased transmission facilities.

C1.2.5 Many DRSN nodes also contain DRSN BLACK (nonsecure) switches. The DRSN BLACK switches provide seamless, nonsecure telephone service to RED DRSN telephone users (i.e., DRSN users can access both RED and BLACK telephone services from a single telephone instrument). The DRSN BLACK switching nodes access a variety of networks including the Defense Switched Network (DSN) and the Public Switched Network (PSN) in the continental United States (CONUS) and foreign service providers.

C1.2.6 As the JCS-designated DRSN System Manager (SM), DISA has overall responsibility for ensuring the security of the DRSN. DISA must protect the overall integrity of the DRSN by ensuring there are no weaknesses in the implementation or operational procedures of any component that can compromise the network. To this end, DISA is responsible for developing, promulgating, and enforcing security guidelines to ensure an effective DRSN security program.

C1.3 Roles and Responsibilities. Key DRSN organizations and individuals with associated roles and responsibilities are described below:

C1.3.1 Office of the Secretary of Defense (OSD). The OSD is responsible for:

C1.3.1.1 Approving the DRSN program plans upon recommendation and consultation with the Joint Staff.

C1.3.1.2 Approving access to non-DoD agencies, organizations, activities, or entities upon consultation with the Joint Staff.

C1.3.2 Joint Staff. The Joint Staff sets policy for the DRSN and approves the addition or deletion of RED switches to the network. Additionally, the Joint Staff is responsible for:

C1.3.2.1 Reviewing the operational effectiveness of the DRSN and reporting to the OSD those matters having a major effect on the network.

C1.3.2.2 Reviewing and approving all requests for FLASH, FLASH OVERRIDE, and FLASH OVERRIDE OVERRIDE capability validated by the Combatant Commanders, Chiefs of the Services, and Directors of Defense Agencies. These capabilities will be revalidated on a biennial basis.

C1.3.2.3 Reviewing and approving all requests for network access to the DRSN and connections between DRSN and non-DRSN secure voice equipment.

C1.3.2.4 Approving special telecommunications survivability requirements for the DRSN.

C1.3.2.5 Reviewing, validating, and approving service requirements where the desired capability adversely affects the network.

C1.3.3 Defense Information Systems Agency (DISA). DISA is the System Manager (SM) of the DRSN and is responsible for developing, issuing, and enforcing security guidelines to ensure an effective DRSN security program. DISA will continually monitor potential DRSN security threats and vulnerabilities to ensure they are effectively countered. In addition, DISA provides DRSN connectivity and network management; and coordinates and reviews Combatant Commander, Service, and agency policies and procedures, when requested. DISA also collects and maintains DRSN configuration management information.

C1.3.3.1 Designated Approving Authority (DAA). The Director, DISA, is the DAA for DRSN switches processing collateral information. The DAA is responsible for:

C1.3.3.1.1 Ensuring all collateral switches connected to the DRSN meet minimum essential security requirements.

C1.3.3.1.2 Ensuring switch interoperability, uniformity, and balanced security across the entire DRSN.

C1.3.3.1.3 Providing DRSN security-relevant interface criteria.

C1.3.3.1.4 Evaluating switch and network safeguards.

C1.3.3.1.5 Maintaining cognizance oversight of certifications and accreditations (in concert with the DAA and the DIA).

C1.3.3.1.6 Approving risk analysis of the DRSN in its operational environment.

C1.3.3.1.7 Approving collateral site certification plans and reports.

C1.3.3.1.8 Resolving conflicts among the Operations and Maintenance (O&M) users.

C1.3.3.2 GIG-Combat Support Directorate (GIG-CS), Chief, DRSN Division (NS4). The Chief, NS4 oversees the security posture of the entire DRSN. These responsibilities fall into three main categories: procurement support, acquisition and acceptance, and compliance verification. The Chief, DRSN Division, is responsible for the following:

C1.3.3.2.1 Guiding the DoD component and procurement activities in fulfilling security and integrity requirements of the DRSN procurement and installation contractual documentation.

C1.3.3.2.2 Monitoring the acquisition and acceptance process to ensuring that all switches satisfy the DRSN security and integrity requirements.

C1.3.3.2.3 Monitoring compliance with DoD security policies and ensuring current accreditation guidelines are followed.

C1.3.4 Combatant Commanders. The Combatant Commanders, in coordination with DISA and the Joint Staff, are responsible for:

C1.3.4.1 Defining, validating, coordinating, and approving requirements for telecommunications services within their purview.

C1.3.4.2 Forwarding approved DRSN requirements and Priorities to Joint Staff and coordinating with DISA and supporting Services for implementation.

C1.3.4.3 Providing policy guidance and procedural conformance. Coordinate existing policy with the Services and DISA for use of DRSN.

C1.3.4.4 Providing acquisition, operation, maintenance, security, and funding of customer premise equipment, including secure voice requirements.

C1.3.4.5 Coordinating with DISA, NS4 before submitting requirement to Joint Staff to determine if a DRSN service request is technically possible, that requirement meets DRSN standards and with out degrading the DRSN network.

C1.3.4.6 Implementing controls for and monitoring the use of precedence, on-and-off netting, and unofficial use of the DRSN to prevent fraud, waste, or abuse.

C1.3.4.7 Supporting DISA in the Operational elements through the GNSC/GNOSC in exercises where deployed units have DRSN Switches and users that are not under the direct control of DISA’s Network Management capabilities or area of control.

C1.3.4.8 Reviewing and validating operational requirements for DRSN switches under their operational control to Joint Staff for approval.

C1.3.4.9 Exercising review and approval authority over requirements for IMMEDIATE, PRIORITY, and ROUTINE precedence capability and revalidating these requirements on a biennial basis.

C1.3.4.10 Validating and forwarding requirements for FLASH, FLASH OVERRIDE, and FLASH OVERRIDE OVERRIDE to the Joint Staff for approval.

C1.3.4.11 Implementing policies and procedures for the provisions of their assigned responsibilities. These procedures are coordinated with DISA to ensure that they are in agreement with the overall DRSN operations.

C1.3.5 Defense Intelligence Agency (DIA). DIA has delegated responsibility for safeguarding Sensitive Compartmented Information (SCI) and for accreditation of switches located within SCI Facilities (SCIFs) to the DAA. (Threat analysis is provided to DISA by the DAA.)

C1.3.6 National Security Agency (NSA). NSA, as a DRSN security advisor to DISA, is responsible for:

C1.3.6.1 Serving as security and Information Security (INFOSEC) advisor for DRSN.

C1.3.6.2 Recommending countermeasures based on DIA threat analysis in conjunction with DSRN security designs.

C1.3.6.3 Coordinating technical parameters of secure voice and other secure terminals with DISA.

C1.3.7 DoD Military Departments (MILDEPs). The United States Air Force (USAF) Ogden Organization-Air Logistics Center (OO-ALC/LHD), is designated as the Lead MILDEP for the DRSN, with the responsibility to provide life-cycle support. The USAF OO-ALC/LHD is also responsible for product level configuration control of hardware, software, and firmware associated with the DRSN. In DRSN switches, software and firmware includes those processing instructions residing in normally unalterable memory that control the functions of call processing and setup (i.e., ringing, dialing, signaling, call connection, and disconnection). OO-ALC/LHD is the responsible training authority for coordinating DRSN equipment training as part of the overall Command and Control Switching System (CCSS) contract. As primary users, the MILDEPs are responsible for the O&M of their respective DRSN switches and for:

C1.3.7.1 Designating the MILDEP organizations (e.g., HQ and O&M units) responsible for performing DRSN system security functions.

C1.3.7.2 Providing information to changes concerning designated OPRs responsible for performing these functions.

C1.3.7.3 Providing support to the organizations assigned responsibilities for DRSN security and integrity.

C1.3.8 Operations and Maintenance (O&M) Activities. Each O&M activity is responsible for maintaining the day-to-day security of its DRSN switch. This will include as a minimum:

C1.3.8.1 Maintaining current publication sets pertaining to DRSN RED switches.

C1.3.8.2 Appointing an Information Assurance Officer (IAO) for each DRSN RED switch, and providing DISA SM copies of the appointment memo.

C1.3.8.3 Complying with all DISA directed security policies.

C1.3.8.4 Developing a strong, comprehensive security program capable of maintaining the security of the DRSN.

C1.3.8.5 Insuring that DRSN users have adequate training on DRSN instruments.

C1.4 System Security Threats. During the early stages of the DRSN planning and development, it became clear that security measures were essential to counter possible vulnerabilities and threats. Because of a Joint Staff tasking, DISA with assistance from NSA, analyzed the DRSN security requirements. The resultant security objectives were then incorporated into the DRSN program. DRSN, like all other DoD communications systems, is subject to numerous threats from a variety of sources. These threats can take the form of passive threats such as the monitoring of individual communications channels or active threats (e.g., jamming, masquerade, interference, and denial of service). These threats come not only from traditional adversaries, but may originate from foreign countries or groups that did not previously possess the technical capability to exploit U.S. communications. A threat may also come from internal U.S. organizations or individuals such as discontent citizens, protest groups, and computer hackers. More specific details on these threats may be found in the Defense Intelligence Agency (DIA) Memorandum DIA/DTI-4B, dated 08 October 1992. Some of the specific threats to the DRSN include the following:

C1.4.1 Access by Uncleared Personnel. Access to RED switch telephone instruments is controlled. All DRSN users must hold, as a minimum, the equivalent of a SECRET (S) clearance. DRSN phones are frequently located in areas where uncleared personnel such as support staff, maintenance personnel, and family members have access. Therefore, the disable feature of the phones must be used when cleared personnel are not physically monitoring the instruments.

C1.4.2 Access by Foreign Personnel. Some DRSN nodes provide foreign personnel with unsupervised access to telephone desk sets. Classmark controls limit the access these foreign personnel have to specific communities of DRSN users.

C1.4.3 Traffic Interception. Adversaries may seek to intercept user traffic to analyze the information being exchanged between users.

C1.4.4 Traffic Pattern Analysis. Adversaries may intercept communications between users and analyze the pattern of information exchanges even when the information itself is protected from disclosure. This analysis could reveal increased information exchanges between specific sets of users indicating impending actions by the U.S. (e.g., unit deployments, strike and/or counterstrike, and heightened preparedness).

C1.4.5 Intrusion. Unauthorized persons or adversaries may attempt to gain access to the network to masquerade (imitate an authorized user), steal service, or deny service (tie up the network to deny its use by authorized users).

C1.4.6 Jamming. Adversaries may interfere with channels carried over communications systems using radio wave propagation (satellite, microwave, high frequency).

C1.4.7 Discontented Employees. Personnel who feel mistreated by their chain-of-command or other DoD personnel may attempt to disrupt communication or deny service to customers by accessing and manipulating the switch database or other components of the switching system.

DISAC 300-115-7 Basic Circular DISAC 300-115-7 Table of Contents DISAC 300-115-7 Chapter 2 Publications Listing

C2. CHAPTER 2. Requirements, Accreditation, Security, And Authentication

C2.1 General. This chapter details the DRSN requirements, accreditation, security, and authentication.

C2.2 Requirements. The Chairman, Joint Chiefs of Staff (CJCS), established the policy for secure voice services for the President, Vice President, Secretary of Defense, the Combatant Commanders, all other combatant and support commands, the Joint Chiefs of Staff (JCS), and other authorized users. The J-6A 01665-92, Operational Requirements Document (ORD) for Secure Voice Requirements, dated 17 November 1992, identifies specific requirements for the DRSN. It states the operational requirements for Secure Voice as satisfying TEMPEST requirements, providing Automatic Security Authentication (ASA), establishing connections at the highest common security access level (SAL), displaying distant-end identification and call classification level, and extending secure service to off-premises (long local) users.

C2.3 Accreditation. DRSN RED switches and their associated cryptographic interfaces, cryptographic equipment, consoles, and subscriber terminals must be accredited by the appropriate DAA in order to process classified information. The Director of DISA is the DAA for switches that process only collateral information. Collateral accreditation is accomplished by establishing four phases of DIACAP; definition, verification, validation and post accreditation in accordance with DoDI 8510.01,Information Assurance Certification and Accreditation Process (DIACAP) 28 November 2007. To provide SCI accreditation the DAA shall determine the Confidentiality Protection Levels, and the Integrity and Availability Levels-of Concern, have been implemented in accordance with reference 4.1 (DCID 6-3). Switch accreditations are accomplished every three (3) years. Failure to maintain a current accreditation will result in termination of DRSN service. Further accreditation guidance can be found in chapter C6.

C2.4 Security Criteria. Security criteria for configuring and operating the DRSN are as follows:

C2.4.1 Components. Each DRSN RED switch node must have published procedures for ensuring the security of the facility and the network. These procedures must as a minimum address the safeguarding of the switch enclave, enforcing access controls to switch components, assigning subscriber terminal identifications and class markings, modifying the switch firmware and software, enforcing access controls for off premise (long local) services to customers, enforcing access controls for users outside the enclave where the switch resides, emergency procedures, identification of user responsibilities, and security education and training for users and maintenance Systems Administration personnel.

C2.4.2 Information Assurance Officer (IAO). The local commander responsible for each DRSN RED switch must appoint, prior to accreditation testing, an Information Assurance Officer (IAO) to develop the security plan for the switch and oversee its implementation. The IAO, in coordination with the local Special Security Officer (SSO), is responsible to DISA SM for RED switch security throughout the lifecycle of the system. The local commander responsible for operation of the switch must ensure the IAO receives adequate training. The IAO and SSO may not be the same person. The IAO may be contract personnel.

C2.4.3 Database File Control. Configuration control of the DRSN RED switch database files (including discretionary access control and audit control) is the responsibility of each local IAO. DRSN RED switch database files include those data files that can be accessed and altered by the administration and maintenance console operator; are generally used to determine interconnection and access priorities, authorities, and classification privileges; and store audit trails and passwords.

C2.4.4 Integrity Procedures. Procedures must be in place to insure the integrity of master copies of all operational software, operational backup files, audit information and current hardware/firmware configuration data. These procedures must include handling and inventory of software and must also prescribe procedures for maintaining a current hardware/firmware configuration listing.

C2.4.5 Interface Approval. The Joint Staff must approve the interface of other RED switches with the DRSN. The interfacing switch or network must meet the security criteria stated in this circular. Exceptions to this security policy must be forwarded to the Joint Staff for approval.

C2.4.6 Mandatory Configuration. The mandatory configuration for the DRSN complexes is as follows:

C2.4.6.1 DRSN RED switch consoles and subscriber terminals may initiate or receive secure calls classified SECRET or higher, but will not place or receive BLACK calls directly, unless equipped with a RED/BLACK interface(the IST has an integrated NSA approved RED/BLACK interface built into the phone).

C2.4.6.2 DRSN subscriber terminals equipped with an approved RED/BLACK interface capability may be connected to both secured (i.e., through the RED switch) or non-secured (i.e., through a BLACK switch or key system capability) signal lines, but may not operate in both RED and BLACK modes simultaneously. Fail-safe design of the RED/BLACK interface defaulting to RED operation is required.

C2.4.6.3 DRSN RED switch console operators must have an approved security clearance at least to the highest level of the instrument. Personnel may enter or leave established secured calls processed by their switches, provided that a distinctive audible tone is furnished to all participants in the call. The console must have the proper SAL, or the call will be downgraded to the classification of the console. The audible tone must be generated each time the operator enters or leaves an in-progress call.

C2.4.6.4 DRSN RED switch subscriber terminals will not be configured for automatic answering. Public address system interfaces, external speaker interfaces, and console call queues are excluded from this restriction. However, configuration of these excluded devices for automatic answering must be coordinated with DISA, NS4 and approved by the appropriate DAA.

C2.4.6.5 DRSN RED switches must be configured and operated to permit the required disconnection or disabling of subscriber terminals when they are not manned by appropriately cleared personnel.

C2.4.6.6 Each external device used with a DRSN RED switch user-instrument must be configured to operate at the security level of its associated terminal. The DAA must approve operating procedures for devices connected to terminals authorized to process SCI.

C2.4.6.7 Switch and cryptographic interfaces must maintain RED-BLACK isolation throughout the call sequence. When placing a call from a DRSN RED switch terminal through a cryptographic interface connected to nonsecure telephone lines (DSN, commercial networks, etc.), it is acceptable to allow audio from the nonsecure network through the DRSN RED switch to the calling subscriber terminal in order to monitor progress during initial call setup. With the exception of initial call setup of STU-III, Remote Trunk Interfaces (STU-III/R), and Secure terminal equipment (STE), audio from the DRSN RED switch must not be allowed out to the nonsecure network before the cryptographic equipment has entered the secure mode of operation interface T1 SMUs and T1 Voice over Secure IP (VoSIP) with guidelines and details to include. Must be Secret High; T1 must be protected/encrypted from Voice Gateway to the DRSN T1 Trunk. The Ethernet Connection must be connected to SIPRNET and protected at Secret High. SMU Switch T1 Trunk Must be in a trunk card by itself and protected secret, and never shared with an unclassified T1 trunk.

C2.4.6.8 DRSN RED switch subscriber terminals must have a label affixed that indicates the highest security level authorized for the instrument. Color-coding of the line buttons to correspond with the classification level of the line is the acceptable method of identifying multilevel instruments. The required method of identifying the classification of the line is as follows: yellow for SCI, orange for TOP SECRET, red for SECRET, and green for UNCLASS (Black Switch Service). Variations to these colors will be used for other SAL classmarks (i.e., diagonal black lines through color scheme background for TOP SECRET FOREIGN access).

C2.4.6.9 Manual Override of Security features is prohibited. Connection of calls at higher levels than authorized by SALs will not be permitted.

C2.4.6.10 New technology has made it possible to introduce Local Area Network(LAN) technology into the DRSN switching complex. The DEC ALPHA processor allows the connectivity of the RED switch to the Black Switch via a RED/Black LAN. This connectivity allows the System Administrator (SA) to administer both switch databases from a single terminal. Because the ability to configure the RED database exists, the LAN must be protected at the TOP SECRET level for collateral switches, and the SCI level for SCI switches. This means that the LAN must be located within the confines of a TS facility or a SCIF. While traversing nonsecure space, the LAN must be in approved PDS. At no time will the LAN be extended to areas where non-cleared personnel may have access to it.

C2.4.6.11 The Push-To-Talk (PTT) handset is an integral part of the physical protection afforded classified DRSN voice traffic. The DAA will approve the removal of push-to-talk handsets from user instruments under certain circumstances. This is by no means authorization to remove all PTT handsets from a switch. Removal will be approved on a case-by-case basis by the DISA Information Assurance Manager (IAM), and only for when legitimate operational requirements warrant the action. Before removal, the O&M activity must first contact the DISA DRSN IAM and request approval. The user must justify the action, and develop procedures for maintaining the secure integrity of the instrument. These procedures must be forwarded to DISA.

C2.4.7 Level. The classification, SCI character, or foreign access of ongoing conferences established through DRSN RED switches may be changed only if all participants are informed. Upon notification of a security level change of an ongoing conference, conference participants with properly classmarked subscriber terminals will not require reconnection at the new security level; terminals without proper security level will be excluded from the conference. The operator may add new conferees as required as long as new members are at the same level, or the conference downgrades to the level of the new member. Automated update of the security level display for network calls is implemented using the DRSN's ASA capability.

C2.4.8 Measures. In order to maintain the secure integrity of DRSN, security must be paramount in the minds of users and maintainers. DRSN users rely on security safeguards to ensure the accuracy of information being displayed by the instrument. The security policy safeguards associated with the DRSN RED switches are as follows:

C2.4.8.1 Users of DRSN RED switch subscriber terminals are responsible for verifying the need-to-know of the distant parties with whom they communicate.

C2.4.8.2 All personnel authorized uncontrolled access to the physical area in which DRSN RED switch consoles and subscriber terminals are located must ensure that only authorized persons are permitted access to this equipment.

C2.4.8.3 DRSN Phone instruments are equipped with enable/disable codes used to disable the phones when unattended. DRSN Phones will be disabled when not under the immediate control of cleared personnel. It is important to remember that when a DRSN instrument is enabled it is classified at least SECRET, and in many cases TOP SECRET or TS/SCI. If instruments are located in authorized open storage facilities that are cleared for the highest classification of the phone, they may be left enabled. The phones must be disabled at the end of the duty day for facilities that are not occupied continuously.

C2.4.8.4 A password system will be used to restrict access to DRSN RED switch administration and maintenance consoles and to establish the identity of each person gaining access. The IAO will establish procedures for changing passwords and recording that changes have been made. Passwords will be changed every 180 days, after departure of personnel, or after suspected compromise, whichever is sooner.

C2.4.8.5 The IAO will establish procedures for ensuring users are aware of the use of the enable code feature on DRSN instruments. Like passwords, Enable Codes will be changed every 180 days, after departure of personnel, or after suspected compromise, whichever is sooner. The IAO will establish administrative procedures for ensuring enable codes are changed every 180 days, and record that changes have been accomplished.

C2.4.8.6 Any keying material used with the DRSN RED switch cryptographic equipment must be stored and handled in strict compliance with reference 4.2 or with its Service implementing directives. Storage and control of STU-III Cryptographic Ignition Keys (CIKs), STE FORTEZZA Cards, and SECRET cryptographic key material must be in accordance with service directives.

C2.4.8.7 RED signal lines associated with RED switches must be installed in accordance with reference 4.3 or with its Service implementing directives. DRSN RED switches must use separate RED and BLACK distribution systems.

C2.4.9 Auditing. An audit trail must be maintained for all access requests to DRSN RED switch operating information, control functions, and software. This audit trail must be protected from unauthorized access, modification, or destruction and must contain sufficient detail to reconstruct significant events in cases of compromise, unauthorized access, or system malfunction. Additional information is contained in C4.4.2.

C2.5 Authentication.

C2.5.1 Self-Authentication. Each call or conference will self-authenticate to the security level displayed on the conversing DRSN RED switch terminals. Except as noted below, manual authenticators will not be used in the DRSN to verify the security level of calls or conferences.

C2.5.2 Initial Voice Switched Network (IVSN). The North Atlantic Treaty Organization (NATO) Initial Voice Switched Network (IVSN) self-authenticates to NATO SECRET. Manual authentication or positive voice recognition is required before COSMIC TOP SECRET or ATOMAL (i.e., nuclear weapon-related) information may be discussed between DRSN users and IVSN users. SCI information may not be discussed with users of IVSN terminals.

C2.5.3 Point-to-Point. The point-to-point calls between

STU-IIIs/STEs and DRSN RED switch subscriber terminals self-authenticate to the security level indicated on alphanumeric displays on both instruments.

C2.5.4 Security Level Downgrades. Classmarked downgrades of the security level of a call (e.g., TOP SECRET-to-SECRET or

SCI-to-collateral) are allowed in order to bring in lower security level instruments provided that an audio announcement “Barge in Tone” and visual indication is provided to all parties in the call. This requirement also applies to features such as call forwarding, call transfer, and when adding conferees to a conference call.

C2.5.4.1 Calls ideally start at the highest security level common to all instruments involved in the call and rise to the highest security level common to all instruments remaining when one or more instruments drop out, hang up, or are forced out of the call.

C2.5.4.2 If a call is forwarded to an instrument of a lower security level, the security indicators of all the instruments in the call chain will display the highest security level of the new instrument.

C2.5.4.3 If a different instrument whose highest security level is lower than that of an in-progress call is brought into that call, the security indicators of all instruments within the call will display the highest security level of the new instrument to all instruments in that call (i.e., a conference).

C2.5.5 Security Level Upgrades. Classmarked upgrades of the security level of a call (e.g., SECRET-to-TOP SECRET or collateral-to-SCI) are allowed, provided an audio announcement “Barge in Tone” and visual indication is provided to all parties in the call. When upgrades occur, all subscriber instruments that are not authorized for the higher security level must be disconnected or placed in hold status (i.e., no audio connection to the instrument) until a subsequent downgrade occurs.

C2.6 Terminal Displays.

C2.6.1 Display Requirement. Telephone terminals associated with the DRSN must display security level and terminal identification data for the duration of each call. Each DRSN RED switch terminal must complete the following:

C2.6.1.1 Show the highest common security classification or SAL for the connected terminals and interconnecting trunks, show SCI when the connected terminals are authorized to process SCI information, and indicate if non-U.S. personnel have been authorized uncontrolled access to the distant terminal.

C2.6.1.2 Display the terminal identifier associated with distant STU-IIIs/STEs and RED switch subscriber terminals.

C2.6.1.3 Identify the network and/or cryptographic equipment type for calls from RED switches and secure voice equipment that do not transmit terminal identification data.

C2.6.1.4 Be compatible with STU-III/STEs displays.

C2.6.1.5 Indicate the nonsecure nature of all calls and conferences established through a BLACK switch or key system.

C2.6.2 Standard Display Format. With the exception of the Integrated Services Telephone that has a one-line, 40-character display, the DRSN RED switch telephones must have visual displays capable of presenting at least two alphanumeric lines containing at least 16 characters per line. The first line will display the self-authenticating security level of the call or conference in progress. The second line will display the identity data of the distant terminal or identify the network and/or equipment type associated with the distant party. When a conference call is in progress, this will be indicated on the second line of the display.

C2.6.3 Self-Authentication Security Level Displays. Sample DRSN security level displays and the corresponding SAL codes are listed in chapter C3. Consult the SAL tables currently in effect to determine officially authorized codes and the corresponding displays.

C2.7 Network Expansion.

C2.7.1 DRSN RED switches may be incorporated into the DRSN on condition that their operational parameters and practices do not degrade the security or operational effectiveness of the network. Approval must be obtained from the Joint Staff prior to connection to the network using procedures in the Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6215.01B, Policy for Department of Defense Voice Networks, 23 September 2001.

C2.7.2 Non-DRSN RED switches may not provide access to and from DRSN trunks unless approved in accordance with Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6215.01B, Policy for Department of Defense Voice Networks, 23 September 2001. Each trunk to a non-DRSN switch node must be classmarked with a single SAL unless the connected switch supports variable SALs (VSALs) and connected user terminals are equipped with security and/or identification displays.

DISAC 300-115-7 Basic Circular DISAC 300-115-7 Table of Contents DISAC 300-115-7 Chapter 3 Publications Listing

C3. CHAPTER 3. Architecture

C3.1 General. This chapter summarizes the fundamental principles of security, system elements, network security features, and the network management mechanisms of the DRSN.

C3.2 Fundamental Principles of Security. To ensure the security of DRSN voice transmissions, the network architecture must incorporate the following requirements: confidentiality, integrity, authentication, and access controls. These concepts represent the fundamental principles of security. All of the information security controls and safeguards, and all of the threats, vulnerabilities, and security processes are subject to the confidentiality, integrity, authentication, and access controls standards. Each of these requirements is described below.

C3.2.1 Confidentiality. The concept of confidentiality attempts to prevent the intentional or unintentional unauthorized disclosure of a message’s contents. The architecture must protect traffic and other information from unauthorized disclosure. The network carries classified traffic ranging from SECRET to Top Secret and/or SCI. The network architecture security features must protect traffic at a TOP SECRET level and provide additional protection to the specific portions of the network that carry more sensitive information.

C3.2.2 Integrity. The concept of integrity ensures that modifications are not made by unauthorized personnel or processes. The architecture must protect DRSN traffic, supervision, call setup, and control information from unauthorized modification. Furthermore, the architecture will make correct call connections and guard against failures that might cause misconnection or misrouting.

C3.2.3 Authentication. The concept of authentication ensures that the testing or reconciliation of evidence of a user’s identity. It establishes the user’s identity and ensures that the users are who they say they are. Authentication is the ability to verify the user's telephone or console. The architecture must enable the users to authenticate classified levels of voice traffic up to and including TOP SECRET and/or

SCI. The DRSN architecture will enable both calling and called users to display the security level of each call or conference and the identity of the distant terminal.

C3.2.4 Access Control. Access control is the ability to ensure that only authorized personnel use the network. The access control will ensure that only users who are granted security clearances at the appropriate level will be able to access the DRSN through subscriber loops. The architecture will further ensure that only maintenance personnel who are granted security clearances at the appropriate level will be able to access the nodal components such as the switch matrix, the PROMINA nodes, and the Advanced RED DSN Integrated Management Support System (ARDIMSS).